"""Slice 5: Cloudflare inventory only. No new verbs; R2 stays Phase 4."""
from __future__ import annotations

import inspect
import uuid

from src.core import turnstile as turnstile_mod
from src.domain.connectors.catalog import CONNECTORS, get_action, slugs_implementing
from src.domain.connectors.invoke_capabilities import (
    CAPABILITY_CONVERSION_PATTERN,
    CLOUDFLARE_DOMAIN_AUDIT,
    INVOKE_CAPABILITIES,
    STORAGE_FAMILY_PLAN,
)
from src.domain.connectors.public_gateway import (
    PHASE_4_STATUS,
    PHASE_5_STATUS,
    PUBLIC_INVOCABLE_CAPABILITIES,
)
from src.domain.connectors.resource_resolve import (
    ResourceConnection,
    ResourceError,
    resolve_resource,
)
from src.domain.edge_functions import cf_runtime
from src.integrations.cloudflare_client import CloudflareClient


def test_slice_five_completes_without_opening_a_cloudflare_family() -> None:
    pattern = CAPABILITY_CONVERSION_PATTERN
    audit = CLOUDFLARE_DOMAIN_AUDIT
    assert PHASE_5_STATUS == "complete"
    assert pattern["phase_5_status"] == "complete"
    assert pattern["phase_4_status"] == "complete"
    assert PHASE_4_STATUS == "complete"
    assert pattern["current_program_phase"] == 8
    assert pattern["next_program_slice"] == "9_app_block_modernization"
    assert audit["status"] == "complete"
    assert audit["family_opened"] is False
    assert audit["catalog_mutated"] is False
    assert audit["phase_4_reopened"] is False
    assert audit["vendor_overall"] == "B"
    assert audit["recommended_next_slice"] == "6_crm_domain_audit"
    assert "5a_turnstile_contract" in audit["not_recommended"]
    assert STORAGE_FAMILY_PLAN["status"] == "complete"
    assert STORAGE_FAMILY_PLAN["opened"] is True


def test_only_customer_cloudflare_connector_is_r2() -> None:
    cf_keys = {key for key in CONNECTORS if key.startswith("cloudflare")}
    assert cf_keys == {"cloudflare_r2"}
    assert "cloudflare_dns" not in CONNECTORS
    assert "cloudflare_turnstile" not in CONNECTORS
    r2 = CONNECTORS["cloudflare_r2"]
    slugs = {action.slug for action in r2.actions}
    assert slugs == set(CLOUDFLARE_DOMAIN_AUDIT["customer_bound_live_actions"])
    for slug in CLOUDFLARE_DOMAIN_AUDIT["provider_specific_r2_actions"]:
        pair = get_action(slug)
        assert pair is not None
        assert pair[1].implements == ()


def test_no_new_cloudflare_capability_verbs() -> None:
    forbidden = CLOUDFLARE_DOMAIN_AUDIT["hypothesized_verbs_not_created"]
    for verb in forbidden:
        assert verb not in INVOKE_CAPABILITIES
        assert verb not in PUBLIC_INVOCABLE_CAPABILITIES
        assert slugs_implementing(verb) == ()
    assert CLOUDFLARE_DOMAIN_AUDIT["new_capability_verbs"] == ()
    assert CLOUDFLARE_DOMAIN_AUDIT["normalization_candidates_this_slice"] == ()
    assert CLOUDFLARE_DOMAIN_AUDIT["turnstile_customer_e2e"] is False
    assert CLOUDFLARE_DOMAIN_AUDIT["dns_customer_e2e"] is False
    assert CLOUDFLARE_DOMAIN_AUDIT["workers_customer_e2e"] is False
    assert CLOUDFLARE_DOMAIN_AUDIT["rules_customer_state"] == "absent"


def test_storage_file_still_customer_bound_and_phase_four() -> None:
    for verb in CLOUDFLARE_DOMAIN_AUDIT["storage_file_already_phase_4"]:
        assert verb in INVOKE_CAPABILITIES
        assert "cloudflare_r2." in " ".join(slugs_implementing(verb))
    platform = ResourceConnection(
        connection_id=uuid.uuid4(),
        connector_key="cloudflare_r2",
        config={"storage_map": {"uploads": {"bucket_name": "acme-uploads", "prefix": ""}}},
        has_secrets=True,
        permissions={slug: "allow" for slug in slugs_implementing("storage.file.put")},
        execution_domain="P",
    )
    try:
        resolve_resource(
            "storage.file.put",
            {
                "storage": "uploads",
                "key": "a.txt",
                "content_base64": "YQ==",
                "content_type": "text/plain",
            },
            [platform],
            enabled_capabilities={"integrations.execute"},
        )
    except ResourceError as exc:
        assert exc.code == "capability_not_bound"
    else:
        raise AssertionError("P2HS-owned R2 must not satisfy storage.file.*")


def test_p2hs_cloudflare_clients_do_not_take_connector_credentials() -> None:
    pages = inspect.getsource(CloudflareClient.__init__)
    assert "get_settings" in pages
    assert "cloudflare_r2" not in pages
    worker = inspect.getsource(cf_runtime._cf_request)
    assert "get_settings" in worker
    assert "cloudflare_api_token" in worker
    assert "connector" not in worker.lower()
    assert "get_settings" in turnstile_mod.verify_turnstile.__code__.co_names
    assert CLOUDFLARE_DOMAIN_AUDIT["app_block_cloudflare_dependencies"] == ()
    assert CLOUDFLARE_DOMAIN_AUDIT["feature_pack_cloudflare_dependencies"] == ()
    assert CLOUDFLARE_DOMAIN_AUDIT["starter_cloudflare_dependencies"] == ()